Use WebFrame::setIsolatedWorldSecurityOrigin to allow cross-origin XHRs in content scripts.

chrome/browser/extensions/cross_origin_xhr_apitest.cc

Index: chrome/browser/extensions/cross_origin_xhr_apitest.cc
diff --git a/chrome/browser/extensions/cross_origin_xhr_apitest.cc b/chrome/browser/extensions/cross_origin_xhr_apitest.cc
index a7f7abb444e52c3c8dbeee0393ef55c96a967525..e8b33ab898054e6cc00caff2dd81e4314a7b2fe9 100644
--- a/chrome/browser/extensions/cross_origin_xhr_apitest.cc
+++ b/chrome/browser/extensions/cross_origin_xhr_apitest.cc
@@ -5,8 +5,14 @@
 #include "chrome/browser/extensions/extension_apitest.h"
 #include "net/base/mock_host_resolver.h"
 
-IN_PROC_BROWSER_TEST_F(ExtensionApiTest, CrossOriginXHR) {
+IN_PROC_BROWSER_TEST_F(ExtensionApiTest, CrossOriginXHRBackgroundPage) {
   host_resolver()->AddRule("*.com", "127.0.0.1");
   ASSERT_TRUE(StartTestServer());
-  ASSERT_TRUE(RunExtensionTest("cross_origin_xhr")) << message_;
+  ASSERT_TRUE(RunExtensionTest("cross_origin_xhr/background_page")) << message_;
+}
+
+IN_PROC_BROWSER_TEST_F(ExtensionApiTest, CrossOriginXHRContentScript) {
+  host_resolver()->AddRule("*.com", "127.0.0.1");
+  ASSERT_TRUE(StartTestServer());
+  ASSERT_TRUE(RunExtensionTest("cross_origin_xhr/content_script")) << message_;
 }